@astrasyncai/adapter-lambda 2.3.0 → 2.4.0

package/dist/lambda/index.js

@@ -1 +1 @@
-"use strict";var me=Object.create;var S=Object.defineProperty;var he=Object.getOwnPropertyDescriptor;var ve=Object.getOwnPropertyNames;var Ae=Object.getPrototypeOf,we=Object.prototype.hasOwnProperty;var Re=(e,t)=>{for(var r in t)S(e,r,{get:t[r],enumerable:!0})},F=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of ve(t))!we.call(e,a)&&a!==r&&S(e,a,{get:()=>t[a],enumerable:!(n=he(t,a))||n.enumerable});return e};var be=(e,t,r)=>(r=e!=null?me(Ae(e)):{},F(t||!e||!e.__esModule?S(r,"default",{value:e,enumerable:!0}):r,e)),Se=e=>F(S({},"__esModule",{value:!0}),e);var Kt={};Re(Kt,{handler:()=>Bt});module.exports=Se(Kt);var X="4.4.0",I=`astrasync-sdk/${X}`;function Ie(e){if(!e)return{"user-agent":I};if(e instanceof Headers){let r=new Headers(e);return r.has("user-agent")||r.set("user-agent",I),r}return Array.isArray(e)?e.some(([n])=>n.toLowerCase()==="user-agent")?e:[...e,["user-agent",I]]:Object.keys(e).some(r=>r.toLowerCase()==="user-agent")?e:{"user-agent":I,...e}}var C=(e,t)=>fetch(e,{...t,headers:Ie(t?.headers)}),Gt=Object.freeze({version:1,mode:"observe",depth:"classify",pathRules:[],sampling:Object.freeze({anonymousBeaconRate:.1}),failurePosture:"open"}),Xt=60*1e3,Yt=1440*60*1e3;function Ce(e,t){for(let r of e)if(Te(r.pattern).test(t))return r}function Te(e){let t=e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*");return new RegExp(`^${t}$`,"i")}var Ee=1,_e=new Set(["cookie","set-cookie","x-csrf-token","proxy-authorization","x-astrasync-signature","x-astrasync-secret","x-hub-signature","x-hub-signature-256","x-astra-verified-hop"]),Pe=["x-astrasync-","kya-","kya_"],Ue=new Set(["authorization","x-api-key","x-goog-api-key","api-key"]);function xe(e){return e==="signature"||e.endsWith("-signature")||e.endsWith("-signature-256")}var ke=new Set(["openai-organization","openai-project","openai-version","openai-processing-ms","anthropic-version","anthropic-beta","x-goog-user-project","x-goog-api-client","user-agent","x-agent-card-url","x-agent-provider"]),Oe=["x-goog-","x-stainless-","x-anthropic-","x-openai-","sec-ch-"],Me=["sk-ant-api03","sk-ant-api","sk-ant","sk-proj","sk-svcacct","sk-or-v1","sk-or","sk-lf","sk-","gsk_","aiza","ya29","ghp_","gho_","github_pat_","xai-","pplx-","r8_","hf_","astra-","astrae-"],Fe=64,D=1024,De=16*1024;function E(e){let t=0;for(let r=0;r<e.length;r++){let n=e.charCodeAt(r);n<128?t+=1:n<2048?t+=2:n>=55296&&n<=56319?(t+=4,r++):t+=3}return t}function Ne(e){if(!e)return;let t=e.trim(),r=t.indexOf(" ");if(r>0){let a=t.slice(0,r).toLowerCase();(a==="bearer"||a==="basic"||a==="token")&&(t=t.slice(r+1).trim())}let n=t.toLowerCase();for(let a of Me)if(n.startsWith(a))return a}function Le(e){return!!(_e.has(e)||Pe.some(t=>e.startsWith(t))||xe(e))}function je(e){return ke.has(e)?!0:Oe.some(t=>e.startsWith(t))}function Y(e){let t={},r={},n,a,i=0,o=0;if(!e)return{headers:t};for(let c of Object.keys(e)){if(o>=Fe)break;let u=c.toLowerCase(),l=e[c];if(l===void 0)continue;let g=Array.isArray(l)?l.join(", "):String(l);if(Ue.has(u)){let d=Ne(g);d&&!n&&(n=d);continue}if(u==="cookie"&&(a=g.split(";").filter(d=>d.trim().length>0).length),Le(u))continue;let m=g;E(m)>D&&(m=m.slice(0,D));let h=E(u)+E(m);i+h>De||(i+=h,o++,t[u]=m,je(u)&&(r[u]=m))}let s={headers:t};return n&&(s.apiKeyFormat=n),Object.keys(r).length>0&&(s.platformHeaders=r),a!==void 0&&(s.cookieCount=a),s}var $e=[{vendor:"claude",displayName:"Anthropic Claude",uaPatterns:[/claude/i,/anthropic/i],agentCardPatterns:[/anthropic\.com/i,/claude\.ai/i],apiKeyFormatPatterns:[/^sk-ant/i],headerPatterns:[/^anthropic-version/i,/^anthropic-beta/i,/^x-anthropic-/i]},{vendor:"chatgpt",displayName:"OpenAI ChatGPT",uaPatterns:[/chatgpt/i,/openai/i,/gpt-?\d/i],agentCardPatterns:[/openai\.com/i,/chatgpt\.com/i],apiKeyFormatPatterns:[/^sk-proj/i,/^sk-svcacct/i],headerPatterns:[/^openai-organization/i,/^openai-project/i,/^openai-version/i]},{vendor:"gemini",displayName:"Google Gemini",uaPatterns:[/gemini/i,/google-gemini/i,/bard/i],agentCardPatterns:[/gemini\.google\.com/i,/ai\.google\.dev/i],apiKeyFormatPatterns:[/^aiza/i],headerPatterns:[/^x-goog-user-project/i,/^x-goog-api-client/i]},{vendor:"cursor",displayName:"Cursor",uaPatterns:[/cursor/i],agentCardPatterns:[/cursor\.sh/i,/cursor\.com/i]},{vendor:"goose",displayName:"Block Goose",uaPatterns:[/goose/i,/block-goose/i],agentCardPatterns:[/block\.xyz\/goose/i,/goose\.tools/i]},{vendor:"perplexity",displayName:"Perplexity",uaPatterns:[/perplexity/i],agentCardPatterns:[/perplexity\.ai/i],apiKeyFormatPatterns:[/^pplx-/i]},{vendor:"chatgpt-atlas",displayName:"ChatGPT Atlas browser",uaPatterns:[/\batlas\/\d/i],headerPatterns:[/^sec-ch-ua: .*atlas/i]},{vendor:"perplexity-comet",displayName:"Perplexity Comet browser",uaPatterns:[/\bcomet\/\d/i],headerPatterns:[/^sec-ch-ua: .*comet/i]},{vendor:"astrasync-sdk",displayName:"AstraSync SDK",uaPatterns:[/^astrasync-sdk\//i]}];function He(e,t){let r=t.userAgent??"",n=t.agentCardUrl??"",a=t.apiKeyFormat??"",i=t.ja4??"",o=t.asn??"",s=[];if(t.platformHeaders)for(let[c,u]of Object.entries(t.platformHeaders))s.push(c,`${c}: ${u}`);for(let c of e){let u=c.uaPatterns?.some(p=>p.test(r)),l=c.agentCardPatterns?.some(p=>p.test(n)),g=a.length>0&&c.apiKeyFormatPatterns?.some(p=>p.test(a)),m=s.length>0&&c.headerPatterns?.some(p=>s.some(y=>p.test(y))),h=i.length>0&&c.ja4Patterns?.some(p=>p.test(i)),d=o.length>0&&c.asnList?.includes(o);if(u||l||g||m||h||d){let p=r.split(/[\s/]/)[0]?.toLowerCase()??"",y=(()=>{try{return n?new URL(n).host:""}catch{return""}})(),A=p||y||a||i||o&&`asn${o}`||"unknown";return{vendor:c.vendor,fingerprintKey:`${c.vendor}:${A}`,displayName:c.displayName}}}}function N(e){return He($e,e)}function Be(e){return e>=80?"PLATINUM":e>=60?"GOLD":e>=40?"SILVER":"BRONZE"}var Jt=3600*1e3,Ke=new Map;function Ve(e){return Ke.get(e)?.data}var J={apiBaseUrl:"https://astrasync.ai/api",defaultAccessLevel:"none",debug:!1},W=!1,L=!1;async function j(e,t,r,n){W=!0;try{let a=`${e}/agents/verify-access`,o=(await C(a,{method:"HEAD"})).headers.get("content-type")??"";if(o.startsWith("text/html")){let s=`[VerificationGateway] apiBaseUrl '${e}' returned HTML (content-type: ${o}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;if(r)throw new Error(`${s} (strictInit=true)`);console.warn(`${s} Set disableInitChecks: true on GatewayConfig to silence.`)}else t&&console.log(`[VerificationGateway] init check passed for ${e} (content-type: ${o})`);if(n){let s=await C(`${e}/agents/verify-access/self-check`,{headers:{Authorization:`Bearer ${n}`}});if(s.status===401){let c=await s.json().catch(()=>({})),u=`[VerificationGateway] the configured AstraSync API key was REJECTED at startup (${c.code??"api_key_invalid"}: ${c.message??"invalid key"}). Every inbound agent will be turned away until the key is rotated`+(c.remediation?.manageUrl?` at ${c.remediation.manageUrl}`:"")+".";if(r)throw new Error(`${u} (strictInit=true)`);console.error(u)}else if(s.ok){let c=await s.json().catch(()=>({}));typeof c.daysToExpiry=="number"&&c.daysToExpiry<=7?console.warn(`[VerificationGateway] the configured AstraSync API key expires in ${c.daysToExpiry} day(s) \u2014 rotate it at Settings \u2192 Developer Tools before integrations start failing.`):t&&console.log("[VerificationGateway] API key self-check passed")}}}catch(a){if(r)throw a;t&&console.log(`[VerificationGateway] init check failed (non-blocking): ${String(a)}`)}}var P=new Map;function Z(e,t){let r=e.credentials;return[r.astraId||"",r.apiKey||"",r.jwt||"",e.purpose||"",e.action||"",e.resourceType||"",e.resource||"",e.jurisdiction||"",e.transactionValue??"",e.currency||"",t||"",e.counterpartyUrl||"",e.counterpartyType||"",e.isSubAgentRequest?"1":"0",e.parentAgentId||"",e.subAgentDepth??"",e.durationRequired??"",e.invocationProtocol||"",e.enableRuntimeChallenge?"1":"0",e.callerMetadata?.sourceIp||"",e.callerMetadata?.userAgent||"",e.callerMetadata?.forwardedFor||"",e.callerMetadata?.agentCardUrl||""].join("|")}function ze(e,t){let r=Z(e,t),n=P.get(r);return n&&n.expiresAt>Date.now()?n.result:(n&&P.delete(r),null)}var Ge=60;function Xe(e,t,r,n){let a=r&&r>0?r:Ge,i=Z(e,n);P.set(i,{result:t,expiresAt:Date.now()+a*1e3})}function Q(e,t){let r={},n=/^ASTRAE?-[A-Za-z0-9_-]{1,64}$/,a=e["x-astra-id"]||e["X-Astra-Id"]||e["X-ASTRA-ID"]||e["x-astra-agentid"]||e["X-Astra-AgentId"]||e["x-astra-agent-id"]||e["X-Astra-Agent-Id"]||e["X-ASTRA-AGENT-ID"];if(a){let s=Array.isArray(a)?a[0]:typeof a=="string"?a:void 0;typeof s=="string"&&n.test(s)&&(r.astraId=s)}let i=e["x-api-key"]||e["X-Api-Key"]||e["X-API-KEY"];i&&(r.apiKey=Array.isArray(i)?i[0]:i);let o=e.authorization||e.Authorization;if(o){let s=Array.isArray(o)?o[0]:o;typeof s=="string"&&(r.authorizationHeader=s,s.startsWith("Bearer ")&&(r.jwt=s.slice(7)))}return t&&(t.astraId&&!r.astraId&&(r.astraId=t.astraId),t.apiKey&&!r.apiKey&&(r.apiKey=t.apiKey)),r}function Ye(e,t,r={}){let n=r.source??"no_credentials",a=n==="api_error",i=n==="merchant_misconfig",o=r.urls,s=i?{message:"This site's AstraSync integration is misconfigured (its API key was revoked, expired, or rotated). Your identity and the AstraSync platform are fine \u2014 contact the site operator. Retrying will not help.",registrationUrl:o?.registrationUrl??"",documentationUrl:r.remediation?.docsUrl??o?.documentationUrl??"",steps:["Report the failure to the site operator \u2014 their AstraSync API key needs rotating","Do not retry: the failure is deterministic until the operator updates their key"]}:a?{message:"Verification is temporarily unavailable. Retry with exponential backoff; if the issue persists, contact support with the correlationId.",registrationUrl:o?.registrationUrl??"",documentationUrl:o?.documentationUrl??"",steps:["Retry the request with exponential backoff","If failures persist, share the correlationId with support"]}:{message:"This service verifies AI agents before granting access. Please register your agent with AstraSync.",registrationUrl:o?.registrationUrl??"",documentationUrl:o?.documentationUrl??"",steps:["Register for an AstraSync account","Create and register your agent","Add your ASTRA-ID to request headers","Retry your request"]};return{identityVerified:!1,policyAllowed:!1,accessLevel:"none",guidance:s,denialReasons:t?[t]:["No valid agent credentials provided"],failures:i?[{dimension:"verify_access.merchant_misconfigured",message:t??"The integration API key was rejected by AstraSync",guidance:s.message}]:a?[{dimension:"verify_access.api_error",message:t??"Verification temporarily unavailable",guidance:s.message}]:void 0,...i&&{misconfigured:!0},correlationId:r.correlationId,attemptId:r.attemptId,verifiedAt:new Date}}async function Je(e,t){let{credentials:r,...n}=t,a={...r.astraId&&{agentId:r.astraId},...n.purpose&&{purpose:n.purpose}};if(n.action&&(a.action=n.action),n.resourceType&&(a.resourceType=n.resourceType),n.resource&&(a.resource=n.resource),n.jurisdiction&&(a.jurisdiction=n.jurisdiction),n.transactionValue&&(a.transactionValue=n.transactionValue),n.currency&&(a.currency=n.currency),n.isSubAgentRequest&&(a.isSubAgentRequest=n.isSubAgentRequest),n.parentAgentId&&(a.parentAgentId=n.parentAgentId),n.subAgentDepth!==void 0&&(a.subAgentDepth=n.subAgentDepth),n.enableRuntimeChallenge&&(a.enableRuntimeChallenge=n.enableRuntimeChallenge),n.createSession&&(a.createSession=n.createSession),n.durationRequired&&(a.durationRequired=n.durationRequired),n.counterpartyType&&(a.counterpartyType=n.counterpartyType),n.counterpartyUrl&&(a.counterpartyUrl=n.counterpartyUrl),e.counterpartyId&&(a.counterpartyId=e.counterpartyId),n.runtimeChallengeOptions&&(a.runtimeChallengeOptions=n.runtimeChallengeOptions),n.invocationProtocol&&(a.invocationProtocol=n.invocationProtocol),n.commerceArtifacts&&(a.commerceArtifacts=n.commerceArtifacts),n.attemptId&&(a.attemptId=n.attemptId),n.considerationSet&&(a.considerationSet=n.considerationSet),a.sdkVersion=X,n.callerMetadata||n.clientIp||n.userAgent){let o={...n.clientIp&&{sourceIp:n.clientIp},...n.userAgent&&{userAgent:n.userAgent},...n.callerMetadata};Object.keys(o).length>0&&(a.callerMetadata=o)}let i={"Content-Type":"application/json",...e.customHeaders};e.apiKey&&(i.Authorization=`Bearer ${e.apiKey}`,i["X-API-Key"]=e.apiKey);try{let o=await C(`${e.apiBaseUrl}/agents/verify-access`,{method:"POST",headers:i,body:JSON.stringify(a),signal:AbortSignal.timeout(e.verifyTimeoutMs??1e4)}),s=await o.json();return o.status===410?{success:!0,attemptId:typeof s?.attemptId=="string"?s.attemptId:void 0,access:{allowed:!1,accessLevel:"none",reason:"endpoint_deactivated",failures:[{dimension:"endpoint.deactivated",message:typeof s?.message=="string"?s.message:"Endpoint has been deactivated",guidance:typeof s?.guidance=="string"?s.guidance:"Reactivate via POST /api/endpoints/{id}/reactivate, or update the URL on the calling agent."}]}}:o.ok?s:o.status===401?{success:!1,error:s.message||s.error||"Integration API key rejected",misconfig:!0,misconfigCode:typeof s?.code=="string"?s.code:void 0,remediation:s?.remediation&&typeof s.remediation=="object"?s.remediation:void 0,correlationId:typeof s?.correlationId=="string"?s.correlationId:void 0,attemptId:typeof s?.attemptId=="string"?s.attemptId:void 0}:{success:!1,error:s.message||s.error||`API returned ${o.status}`,correlationId:typeof s?.correlationId=="string"?s.correlationId:void 0,attemptId:typeof s?.attemptId=="string"?s.attemptId:void 0}}catch(o){return{success:!1,error:`Failed to call verify-access API: ${o instanceof Error?o.message:"Unknown error"}`}}}async function $(e,t,r){let n={...J,...e},a=n.apiBaseUrl?Ve(n.apiBaseUrl):void 0;if(!W&&!n.disableInitChecks&&n.apiBaseUrl&&(n.strictInit?await j(n.apiBaseUrl,n.debug,!0,n.apiKey):j(n.apiBaseUrl,n.debug,!1,n.apiKey)),!L&&(e.minTrustScore!==void 0||e.minTrustScoreForFull!==void 0)&&(L=!0,console.warn("[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side.")),n.cacheTtl!==0&&!r?.bypassCache){let y=ze(t,n.counterpartyId);if(y){n.debug&&console.log("[VerificationGateway] Returning cached result");let A={...y};return t.attemptId?A.attemptId=t.attemptId:delete A.attemptId,A}}let i={...t};!i.counterpartyUrl&&n.counterpartyUrl&&(i.counterpartyUrl=n.counterpartyUrl),!i.counterpartyType&&n.counterpartyType&&(i.counterpartyType=n.counterpartyType),n.debug&&console.log("[VerificationGateway] Calling verify-access API");let o=await Je(n,i),s=o.denialReasons,c=Array.isArray(s)&&s.length>0?s:void 0;if(!o.success)return Ye(n,o.error,{source:o.misconfig?"merchant_misconfig":"api_error",correlationId:o.correlationId,attemptId:o.attemptId,remediation:o.remediation,urls:a});if(!o.access?.allowed){let y=o.access?.failures;return{identityVerified:o.verificationContext?.idVerified===!0,policyAllowed:!1,accessLevel:"none",denialReasons:c??(y&&y.length>0?y.map(ye=>ye.message):o.access?.reason?[o.access.reason]:["Access denied"]),failures:y,requiresStepUp:o.access?.requiresStepUp,requiresApproval:o.access?.requiresApproval,guidance:{message:o.access?.reason||"Access denied by PDLSS policy",registrationUrl:a?.registrationUrl??"",documentationUrl:a?.documentationUrl??""},verifiedAt:new Date,sessionId:o.sessionId,correlationId:o.correlationId,attemptId:o.attemptId,recommendation:o.recommendation,recommendationReasons:o.recommendationReasons,stepUpApproval:o.stepUpApproval,settlement:o.settlement}}let u=o.agent?{astraId:o.agent.astraId,name:o.agent.name,trustScore:o.agent.trustScore,trustLevel:Be(o.agent.trustScore),blockchainVerified:o.agent.blockchainStatus==="verified",status:o.agent.agentStatus}:void 0,l=o.developer?{astradId:o.developer.kyaOwnerId,name:o.developer.fullName,trustScore:o.developer.trustScore||0,verified:o.developer.identityVerified}:void 0,g=o.organization?{name:o.organization.name,verified:o.organization.verified,trustScore:o.organization.trustScore}:void 0,m=o.verificationContext,h=o.access?.accessLevel??"standard",d={identityVerified:o.verificationContext?.idVerified!==!1,policyAllowed:!0,accessLevel:h,agent:u,developer:l,organization:g,appliedPolicy:o.access?.appliedPolicy,verificationContext:m,requiresStepUp:o.access?.requiresStepUp,requiresApproval:o.access?.requiresApproval,verifiedAt:new Date,cacheTtl:n.cacheTtl,sessionId:o.sessionId,correlationId:o.correlationId,attemptId:o.attemptId,runtimeChallenge:o.runtimeChallenge,tokenGuidance:o.tokenGuidance,recommendation:o.recommendation,recommendationReasons:o.recommendationReasons,warningHeader:o.warningHeader,stepUpApproval:o.stepUpApproval,settlement:o.settlement};d.recommendation==="deny"?(d.policyAllowed=!1,d.accessLevel="none",d.denialReasons=c??d.recommendationReasons??["Access denied by AstraSync recommendation"],d.guidance=d.runtimeChallenge?{message:`Verification failed: ${d.runtimeChallenge.reason||"runtime challenge failed"}`,registrationUrl:a?.registrationUrl??"",documentationUrl:a?.documentationUrl??""}:{message:d.recommendationReasons?.[0]||"Access denied by AstraSync recommendation",registrationUrl:a?.registrationUrl??"",documentationUrl:a?.documentationUrl??""}):d.recommendation==="step_up_required"&&(d.requiresStepUp=!0,d.denialReasons=c??d.recommendationReasons??["Step-up verification required"]);let p=d.requiresStepUp===!0||d.requiresApproval===!0||d.recommendation==="step_up_required";return n.cacheTtl!==0&&d.recommendation!=="deny"&&!p&&Xe(t,d,n.cacheTtl,n.counterpartyId),d}async function We(e,t){let r=e.apiBaseUrl||J.apiBaseUrl,{counterpartyUrl:n,...a}=t,i={...a,...n&&{counterpartyUrl:n},...e.counterpartyId&&{counterpartyId:e.counterpartyId}};await C(`${r}/verification-activity/unregistered-attempt`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)}).catch(()=>{})}function f(e,t){return e.headers[t.toLowerCase()]}function Ze(e,t){let r=e.querystring?`?${e.querystring}`:"";return`https://${t}${e.uri}${r}`}function x(e){let{headers:t,apiKeyFormat:r,platformHeaders:n,cookieCount:a}=Y(e.headers),i=e.connection??{},o=et(e.querystring);return{headers:t,...r&&{apiKeyFormat:r},...n&&{platformHeaders:n},...Object.keys(i).length>0&&{connection:i},...a!==void 0&&{cookieCount:a},...o&&{queryKeys:o},schemaVersion:Ee}}var Qe=32,qe=64;function et(e){if(!e)return;let t;try{t=new URLSearchParams(e)}catch{return}let r=[];for(let n of t.keys()){let a=n.toLowerCase().slice(0,qe);if(a&&!r.includes(a)&&(r.push(a),r.length>=Qe))break}return r.length>0?r:void 0}var tt=/^eyJ[\w-]+\.[\w-]*\.[\w-]+~/;function rt(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r=t+"=".repeat((4-t.length%4)%4),n=atob(r),a=new Uint8Array(n.length);for(let i=0;i<n.length;i++)a[i]=n.charCodeAt(i);return new TextDecoder().decode(a)}function nt(e){try{let t=e.split(".")[0];return JSON.parse(rt(t))}catch{return}}function at(e){if(e)try{let t=JSON.parse(e);return typeof t=="object"&&t!==null?t:void 0}catch{return}}function ot(e,t){let r=Ze(e,t),n=e.method,a=e.headers,i=at(e.bodyText),o=e.bodyTruncated?{bodyTruncated:!0}:{},s=f(e,"authorization"),c=s?.replace(/^Bearer\s+/i,""),l=[f(e,"x-payment-mandate")??f(e,"payment-mandate"),c].find(d=>d&&tt.test(d));if(l){let d=nt(l)?.typ;return{protocol:"vi-sd-jwt",artifacts:{viSdJwt:l},evidence:{typ:d,...o}}}let g=f(e,"signature"),m=f(e,"signature-input");if(g&&m){let d=f(e,"signature-agent"),p=f(e,"x-agent-registry"),y=m.toLowerCase();return{protocol:d?"rfc9421-web-bot-auth":p?.toLowerCase().includes("visa")||y.includes("visa")?"rfc9421-tap":p?.toLowerCase().includes("mastercard")||y.includes("mastercard")?"rfc9421-agent-pay":"rfc9421",artifacts:{rfc9421:{headers:a,method:n,url:r,...e.bodyText&&{body:e.bodyText}}},evidence:{...d&&{signatureAgent:d},...p&&{registryHint:p},keyid:m.match(/keyid="([^"]+)"/)?.[1],...o}}}let h=f(e,"timestamp");if(g&&!m&&(h||f(e,"idempotency-key")))return{protocol:"acp",artifacts:{acpRequest:{method:n,url:r,headers:a,...e.bodyText&&{rawBody:e.bodyText},...i&&{body:i}}},evidence:{hasTimestamp:!!h,...o}};if(/\/checkout[-_]sessions(\/|$)/.test(e.uri))return{protocol:"ucp",artifacts:{ucpRequest:{method:n,url:r,...i&&{body:i}}},evidence:{path:e.uri,...o}};if(i){let d=i.intent_mandate??i.intentMandate,p=i.cart_mandate??i.cartMandate,y=i.payment_mandate??i.paymentMandate;if(typeof d=="string"||typeof p=="string"||typeof y=="string")return{protocol:"ap2",artifacts:{ap2Mandates:{...typeof d=="string"&&{intent:d},...typeof p=="string"&&{cart:p},...typeof y=="string"&&{payment:y}}},evidence:{mandatesPresent:[typeof d=="string"&&"intent",typeof p=="string"&&"cart",typeof y=="string"&&"payment"].filter(Boolean),...o}}}if(s&&/^Payment\s+/i.test(s))return{protocol:"mpp",artifacts:{mppRequest:{method:n,url:r,headers:a,...e.bodyText&&{rawBody:e.bodyText},...i&&{body:i}}},evidence:o};if(f(e,"x-payment"))return{protocol:"x402",artifacts:{x402Request:{method:n,url:r,headers:a,...i&&{body:i}}},evidence:o}}var it=/\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|pdf|txt|xml)$/i,st=/curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i,ct=/mozilla\/\d/i;function dt(e,t){if(it.test(t))return{mode:e.mode,depth:e.depth,skip:!0};let r=Ce(e.pathRules,t);return r?{mode:r.mode??e.mode,depth:r.depth??e.depth,skip:r.skip===!0}:{mode:e.mode,depth:e.depth,skip:!1}}function ut(e,t,r){let n=f(e,"user-agent")??"",a=Q(e.headers,{});if(a.astraId||a.apiKey||a.jwt)return{tier:"verified",protocol:"x-astra"};let{apiKeyFormat:i,platformHeaders:o}=Y(e.headers),s={userAgent:n,apiKeyFormat:i,platformHeaders:o};if(r!=="classify"){let u=ot(e,t);if(u)return{tier:"identified",protocol:u.protocol,artifacts:u.artifacts,evidence:u.evidence,fingerprint:N(s)}}let c=N(s);return c?{tier:"identified",protocol:"platform-ua",fingerprint:c}:!n||st.test(n)||!ct.test(n)?{tier:"anonymous-bot",evidence:{userAgent:n||"(none)"}}:!f(e,"sec-fetch-mode")&&!f(e,"accept-language")?{tier:"anonymous-bot",evidence:{userAgent:n,spoofedBrowser:!0}}:{tier:"human"}}var lt={"vi-sd-jwt":"This request presented Visa Intelligent Commerce credentials, but the agent is not verified with AstraSync. Register the agent to pair your VI credentials with a verified identity and mandate.","rfc9421-agent-pay":"This request carried a Mastercard Agent Pay signature, but the agent is not verified with AstraSync. Register the agent to pair Agent Pay credentials with a verified identity and mandate.","rfc9421-tap":"This request carried a Visa TAP signature, but the agent is not verified with AstraSync. Register the agent to pair TAP credentials with a verified identity and mandate.","rfc9421-web-bot-auth":"This request carried a Web Bot Auth signature, but the agent is not verified with AstraSync. Register the agent to link your signed-agent identity to a verified principal.",rfc9421:"This request carried an RFC 9421 HTTP message signature, but the agent is not verified with AstraSync. Register the agent to link the signing identity to a verified principal.",acp:"This request used the Agentic Commerce Protocol, but the agent is not verified with AstraSync. Register the agent to transact on this property.",ucp:"This request used a UCP checkout session, but the agent is not verified with AstraSync. Register the agent to transact on this property.",ap2:"This request presented AP2 mandates, but the agent is not verified with AstraSync. Register the agent to pair your mandates with a verified identity.",mpp:"This request presented MPP payment credentials, but the agent is not verified with AstraSync. Register the agent to transact on this property.",x402:"This request used x402 payment headers, but the agent is not verified with AstraSync. Register the agent to transact on this property.","platform-ua":"This traffic was identified as a platform AI agent without AstraSync credentials. Register the agent to access this property with a verified identity.","x-astra":"The presented AstraSync credentials failed verification or were denied by this property\u2019s access policy."};function pt(e,t){let r=t.replace(/\/api\/?$/,""),n=(e.protocol&&lt[e.protocol])??"This request could not be verified by AstraSync.";return{success:!1,error:{code:e.tier==="verified"?"INSUFFICIENT_ACCESS":"UNAUTHORIZED",message:n,...e.protocol&&{protocol:e.protocol},failures:e.reasons,...e.correlationId&&{correlationId:e.correlationId},guidance:{message:e.guidance?.message||"Register this agent with AstraSync to receive verifiable credentials.",registrationUrl:e.guidance?.registrationUrl||`${r}/register`,documentationUrl:e.guidance?.documentationUrl||`${r}/docs/edge-adapter`}}}}function ft(e){return{success:!1,status:"manual_review",message:"This action requires human approval. Poll the step-up approval endpoint and retry once approved.",...e.stepUp&&{stepUpApproval:e.stepUp},...e.correlationId&&{correlationId:e.correlationId}}}var gt="X-Astra-Verified-Hop";function yt(e){return`${e.astraId};${e.sessionId??""};${e.checkedAt}`}var R={trustScore:"X-AstraSync-Trust-Score",agentId:"X-AstraSync-Agent-Id",developerId:"X-AstraSync-Developer-Id",permissions:"X-AstraSync-Permissions",observedDecision:"X-AstraSync-Observed-Decision"},H=["x-astrasync-","x-astra-verified-hop"];function _(){return{action:"pass",injectHeaders:{},stripHeaderPrefixes:[]}}function mt(e,t,r){let n={};if(t.misconfig&&(n[R.observedDecision]="misconfig"),r.mode!=="enforce")return t.decision!=="allow"&&(n[R.observedDecision]=t.decision),Object.assign(n,B(t),K(t)),{action:"pass",injectHeaders:n,stripHeaderPrefixes:H};switch(t.decision){case"deny":return{action:"respond",status:403,headers:{},bodyJson:pt(t,e.apiBaseUrl)};case"manual_review":return{action:"respond",status:202,headers:{"Retry-After":"30"},bodyJson:ft(t)};default:return Object.assign(n,B(t),K(t)),{action:"pass",injectHeaders:n,stripHeaderPrefixes:H}}}function B(e){if(!e.asat)return{};let{trustScore:t,agentId:r,developerId:n,accessLevel:a}=e.asat;return{...t!==void 0&&{[R.trustScore]:String(t)},...r&&{[R.agentId]:r},...n&&{[R.developerId]:n},...a&&{[R.permissions]:a}}}function K(e){let t=e.asat?.agentId;return t?{[gt]:yt({astraId:t,...e.sessionId&&{sessionId:e.sessionId},checkedAt:Date.now()})}:{}}var ht={GET:"data.read",HEAD:"data.read",OPTIONS:"data.read",POST:"data.write",PUT:"data.write",PATCH:"data.write",DELETE:"data.delete"},vt="data.write",At="data";function wt(e){return ht[e.toUpperCase()]??vt}function Rt(e){let t=e.indexOf(":");if(t>=0)return{purpose:e.slice(0,t)};let r=e.indexOf(".");return r>0&&r<e.length-1?{purpose:e.slice(0,r),actionCandidate:e}:{purpose:e}}function bt(e){let t=e.astraPurpose?Rt(e.astraPurpose):void 0,r,n;e.routeAction?(r=e.routeAction,n="route_config"):e.hasCustomActionExtractor&&e.customAction?(r=e.customAction,n="custom_extractor"):!e.hasCustomActionExtractor&&e.astraAction?(r=e.astraAction,n="header"):!e.hasCustomActionExtractor&&t?.actionCandidate?(r=t.actionCandidate,n="purpose_header_derived"):(r=wt(e.method),n="method_table");let a,i;if(e.routePurpose?(a=e.routePurpose,i="route_config"):e.hasCustomPurposeExtractor?e.customPurpose&&(a=e.customPurpose,i="custom_extractor"):t?(a=t.purpose,i="header"):e.legacyPurpose?(a=e.legacyPurpose,i="legacy_header"):e.queryPurpose&&(a=e.queryPurpose,i="query"),!a){let o=r.indexOf(".");o>0?(a=r.slice(0,o),i="action_derived"):(a=At,i="transport_default")}return{purpose:a,action:r,purposeSource:i,actionSource:n}}async function U(e,t){let r;try{return await Promise.race([e,new Promise(n=>{r=setTimeout(()=>n(void 0),t)})])}catch{return}finally{r&&clearTimeout(r)}}async function V(e,t,r,n){let a=U(We({apiBaseUrl:e.apiBaseUrl,counterpartyId:e.counterpartyId},{counterpartyUrl:e.counterpartyUrl,counterpartyType:"website",sourceIp:t.clientIp,userAgent:f(t,"user-agent"),requestPath:t.uri,requestMethod:t.method,protocol:r.protocol,evidence:r.evidence,observedMetadata:x(t)}),n);if(e.waitUntil){e.waitUntil(a);return}await a}function St(e,t=Math.random){return e<=0?!1:e>=1?!0:t()<e}function v(e){return{tier:e.tier,decision:"allow",reasons:[],protocol:e.protocol}}function z(e,t,r,n){let a=bt({method:t.method,astraPurpose:f(t,"x-astra-purpose"),astraAction:f(t,"x-astra-action")}),i=f(t,"x-astra-attempt-id");return{...i&&/^att_[0-9a-f]{32}$/.test(i)&&{attemptId:i},credentials:Q(t.headers,{}),purpose:a.purpose,action:a.action,resource:t.uri,createSession:!0,counterpartyType:"website",counterpartyUrl:e.counterpartyUrl,callerMetadata:{sourceIp:t.clientIp,userAgent:f(t,"user-agent"),referer:f(t,"referer"),host:f(t,"host"),observedMetadata:x(t)},...n&&r.artifacts&&{commerceArtifacts:r.artifacts}}}function G(e,t){let r=v(e);return r.sessionId=t.sessionId,r.correlationId=t.correlationId,r.guidance=t.guidance,t.misconfigured?(r.reasons=["verification key misconfigured \u2014 fail-open (merchant_misconfig)"],r.misconfig=!0,r):t.requiresStepUp||t.stepUpApproval?(r.decision="manual_review",r.reasons=["step-up approval required"],r.stepUp={pollUrl:t.stepUpApproval?.pollUrl,expiresAt:t.stepUpApproval?.expiresAt},r):!t.identityVerified||!t.policyAllowed?(r.decision="deny",r.reasons=t.denialReasons?.length?t.denialReasons:[t.identityVerified?"denied by access policy":"identity not verified"],r):(r.asat={trustScore:t.agent?.trustScore,agentId:t.agent?.astraId,developerId:t.developer?.astradId,accessLevel:t.accessLevel},r)}async function It(e,t,r,n,a,i){let o=e.budgets??{},s=o.beaconMs??300,c=n.mode==="enforce"?o.verifyEnforceMs??3e3:o.verifyObserveMs??1500,u={apiBaseUrl:e.apiBaseUrl,...a&&{apiKey:a},counterpartyId:e.counterpartyId,disableInitChecks:!0};try{switch(r.tier){case"verified":{if(n.depth==="classify")return v(r);let l=await U($(u,z(e,t,r,n.depth==="authorize")),c);if(!l){let g=v(r);return g.reasons=["verify-access unreachable within budget \u2014 fail-open"],g}return G(r,l)}case"identified":{if(n.depth==="authorize"&&r.artifacts){let g=await U($(u,z(e,t,r,!0)),c);if(!g){let m=v(r);return m.reasons=["verify-access unreachable within budget \u2014 fail-open"],m}return G(r,g)}await V(e,t,r,s);let l=v(r);return n.mode==="enforce"&&n.depth!=="classify"&&(l.decision="deny",l.reasons=["agent is not registered with AstraSync"]),l}case"anonymous-bot":return St(i.anonymousBeaconRate,e.random)&&await V(e,t,{...r,protocol:r.protocol??"ua-heuristic"},s),v(r);default:return v(r)}}catch(l){let g=v(r);return g.reasons=[`edge pipeline error \u2014 fail-open: ${l instanceof Error?l.message:String(l)}`],g}}async function q(e,t,r,n){let a=dt(r,t.uri);try{if(a.skip)return{policy:a,application:_()};let i=f(t,"x-forwarded-host")??f(t,"host")??new URL(e.counterpartyUrl).host,o=ut(t,i,a.depth);if(o.tier==="human")return{policy:a,classification:o,application:_()};let s=await It(e,t,o,a,n,r.sampling);return s.decision!=="allow"&&e.log?.("info",a.mode==="enforce"?`${s.decision.toUpperCase()}: ${t.method} ${t.uri}`:`[OBSERVE] would have been ${s.decision.toUpperCase()}: ${t.method} ${t.uri}`,{tier:s.tier,protocol:s.protocol,reasons:s.reasons}),{policy:a,classification:o,outcome:s,application:mt(e,s,a)}}catch(i){return e.log?.("error","edge evaluation error \u2014 passing request through",{error:i instanceof Error?i.message:String(i)}),{policy:a,application:_()}}}function ee(e){return e.Records[0].cf.request}function w(e,t){return e.headers[t.toLowerCase()]?.[0]?.value}function Ct(e){let t={};for(let[r,n]of Object.entries(e))n?.length&&(t[r]=n.map(a=>a.value).join(", "));return t}function Tt(e){let t=e.body;return t?.data?{text:t.encoding==="base64"?Buffer.from(t.data,"base64").toString("utf8"):t.data,truncated:t.inputTruncated===!0}:{truncated:!1}}function Et(e){let t={},r=(i,o,s)=>{let c=w(e,o);c&&(t[i]=s?s(c):c)},n=w(e,"cloudfront-viewer-address");if(n){t.ip=n.replace(/:\d+$/,"");let i=n.match(/:(\d+)$/);i&&(t.sourcePort=i[1])}r("country","cloudfront-viewer-country"),r("countryName","cloudfront-viewer-country-name"),r("region","cloudfront-viewer-country-region"),r("countryRegionName","cloudfront-viewer-country-region-name"),r("city","cloudfront-viewer-city"),r("latitude","cloudfront-viewer-latitude"),r("longitude","cloudfront-viewer-longitude"),r("postalCode","cloudfront-viewer-postal-code"),r("asn","cloudfront-viewer-asn"),r("tlsVersion","cloudfront-viewer-tls");{let i=w(e,"cloudfront-viewer-tls")?.split(":")[1];i&&(t.tlsCipher=i)}r("httpVersion","cloudfront-viewer-http-version"),r("timeZone","cloudfront-viewer-time-zone"),r("metroCode","cloudfront-viewer-metro-code"),r("tlsFingerprint","cloudfront-viewer-ja3-fingerprint"),r("ja4","cloudfront-viewer-ja4-fingerprint"),r("headerOrder","cloudfront-viewer-header-order",i=>i.slice(0,256)),r("headerCount","cloudfront-viewer-header-count");let a=[];for(let[i,o]of[["desktop","cloudfront-is-desktop-viewer"],["mobile","cloudfront-is-mobile-viewer"],["tablet","cloudfront-is-tablet-viewer"],["smarttv","cloudfront-is-smarttv-viewer"]])w(e,o)==="true"&&a.push(i);return a.length&&(t.device=a.join(",")),t}function te(e){let t=Tt(e),r=Et(e),n=w(e,"cloudfront-viewer-address")?.split(":")[0];return{method:e.method,uri:e.uri,querystring:e.querystring??"",headers:Ct(e.headers),...t.text!==void 0&&{bodyText:t.text},...t.truncated&&{bodyTruncated:!0},...n&&{clientIp:n},...Object.keys(r).length>0&&{connection:r}}}function re(e,t){if(t.action==="respond")return Pt(t.status,t.bodyJson,t.headers);for(let r of t.stripHeaderPrefixes)_t(e,r);for(let[r,n]of Object.entries(t.injectHeaders))k(e,r,n);return e}function ne(e){let t=e.origin?.custom?.domainName??e.origin?.s3?.domainName??void 0;if(!t)return;let r=w(e,"host");!r||r===t||(w(e,"x-forwarded-host")||k(e,"X-Forwarded-Host",r),k(e,"Host",t))}function k(e,t,r){e.headers[t.toLowerCase()]=[{key:t,value:r}]}function _t(e,t){let r=t.toLowerCase();for(let n of Object.keys(e.headers))n.startsWith(r)&&delete e.headers[n]}function Pt(e,t,r){let n={"content-type":[{key:"Content-Type",value:"application/json"}]};for(let[a,i]of Object.entries(r??{}))n[a.toLowerCase()]=[{key:a,value:i}];return{status:String(e),statusDescription:e===403?"Forbidden":e===202?"Accepted":"OK",headers:n,body:JSON.stringify(t)}}var Ut="4.4.0",T=`astrasync-sdk/${Ut}`;function xt(e){if(!e)return{"user-agent":T};if(e instanceof Headers){let r=new Headers(e);return r.has("user-agent")||r.set("user-agent",T),r}return Array.isArray(e)?e.some(([n])=>n.toLowerCase()==="user-agent")?e:[...e,["user-agent",T]]:Object.keys(e).some(r=>r.toLowerCase()==="user-agent")?e:{"user-agent":T,...e}}var kt=(e,t)=>fetch(e,{...t,headers:xt(t?.headers)}),M=Object.freeze({version:1,mode:"observe",depth:"classify",pathRules:[],sampling:Object.freeze({anonymousBeaconRate:.1}),failurePosture:"open"}),ae=["observe","enforce"],oe=["classify","authenticate","authorize"];function Ot(e){if(typeof e!="object"||e===null)return!1;let t=e;if(t.version!==1||!ae.includes(t.mode)||!oe.includes(t.depth)||!Array.isArray(t.pathRules))return!1;for(let n of t.pathRules){if(typeof n!="object"||n===null)return!1;let a=n;if(typeof a.pattern!="string"||a.pattern.length===0||a.mode!==void 0&&!ae.includes(a.mode)||a.depth!==void 0&&!oe.includes(a.depth))return!1}let r=t.sampling;return typeof r!="object"||r===null||typeof r.anonymousBeaconRate!="number"||r.anonymousBeaconRate<0||r.anonymousBeaconRate>1?!1:t.failurePosture==="open"}async function Mt(e,t,r){if(!t)return null;let n={Accept:"application/json"};e.apiKey&&(n.Authorization=`Bearer ${e.apiKey}`,n["X-API-Key"]=e.apiKey),r?.etag&&(n["If-None-Match"]=r.etag);try{let a=await kt(`${e.apiBaseUrl}/endpoints/${encodeURIComponent(t)}/edge-config`,{method:"GET",headers:n,signal:AbortSignal.timeout(r?.timeoutMs??5e3)});if(a.status===304)return{notModified:!0};if(!a.ok)return null;let o=(await a.json()).data?.edgeConfig;return Ot(o)?{edgeConfig:o,etag:a.headers.get("etag")??void 0}:null}catch{return null}}var Ft=60*1e3,Dt=1440*60*1e3,b=new Map,O=new Map;function se(e,t){return`${e}|${t}`}function Nt(e){return e.mode!=="enforce"&&!e.pathRules.some(t=>t.mode==="enforce")?e:{...e,mode:"observe",pathRules:e.pathRules.map(t=>t.mode==="enforce"?{...t,mode:"observe"}:t)}}async function ie(e,t){let r=se(e.apiBaseUrl,t),n=O.get(r);if(n)return n;let a=Mt(e,t,{etag:b.get(r)?.etag}).then(i=>{if(i===null)return;let o=Date.now();if("notModified"in i){let s=b.get(r);s&&(s.lastSuccessAt=o);return}b.set(r,{config:i.edgeConfig,etag:i.etag,lastSuccessAt:o})}).finally(()=>{O.delete(r)});return O.set(r,a),a}async function ce(e,t,r){let n=r?.ttlMs??Ft,a=r?.maxStaleMs??Dt,i=se(e.apiBaseUrl,t),o=b.get(i);if(o){let s=Date.now()-o.lastSuccessAt;return s>n&&ie(e,t).catch(()=>{}),s>a?Nt(o.config):o.config}return await ie(e,t).catch(()=>{}),b.get(i)?.config??M}var Lt=900*1e3,de=new Map;async function jt(e){let{SecretsManagerClient:t,GetSecretValueCommand:r}=await import("@aws-sdk/client-secrets-manager");return(await new t({region:"us-east-1"}).send(new r({SecretId:e}))).SecretString??void 0}async function ue(e){if(e.apiKey)return e.apiKey;let t=e.apiKeySecretName;if(!t)return;let r=de.get(t);if(r&&Date.now()-r.fetchedAt<Lt)return r.value;try{let a=await(e.fetchSecret??jt)(t);return de.set(t,{value:a,fetchedAt:Date.now()}),a}catch(n){return e.log?.("warn","Secrets Manager fetch failed \u2014 continuing keyless",{secretName:t,error:n instanceof Error?n.message:String(n)}),r?.value}}async function le(e,t){try{return await ce({apiBaseUrl:e.apiBaseUrl,apiKey:t},e.counterpartyId,{ttlMs:e.configTtlMs})}catch{return e.fallbackConfig??M}}function pe(e){let t=e.log??((r,n,a)=>{console[r==="info"?"log":r](`[astrasync-edge] ${n}`,a??"")});return async function(n){let a=ee(n);try{ne(a);let i=await ue({...e,log:t}),o=await le(e,i),{application:s}=await q({...e,log:t},te(a),o,i);return re(a,s)}catch(i){return t("error","edge handler error \u2014 passing request through",{error:i instanceof Error?i.message:String(i)}),a}}}var $t="https://astrasync.ai/api",fe="",ge="",Ht=void 0;(!fe||!ge)&&console.error("[astrasync-edge] ASTRASYNC_COUNTERPARTY_ID / ASTRASYNC_COUNTERPARTY_URL were not baked into the bundle \u2014 rebuild via infra/deploy.sh with the ASTRASYNC_* env vars set.");var Bt=pe({apiBaseUrl:$t,counterpartyId:fe,counterpartyUrl:ge,apiKeySecretName:Ht});0&&(module.exports={handler});
+"use strict";var ve=Object.create;var S=Object.defineProperty;var Ae=Object.getOwnPropertyDescriptor;var we=Object.getOwnPropertyNames;var be=Object.getPrototypeOf,Re=Object.prototype.hasOwnProperty;var Se=(e,t)=>{for(var r in t)S(e,r,{get:t[r],enumerable:!0})},D=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of we(t))!Re.call(e,a)&&a!==r&&S(e,a,{get:()=>t[a],enumerable:!(n=Ae(t,a))||n.enumerable});return e};var Ie=(e,t,r)=>(r=e!=null?ve(be(e)):{},D(t||!e||!e.__esModule?S(r,"default",{value:e,enumerable:!0}):r,e)),Ee=e=>D(S({},"__esModule",{value:!0}),e);var Xt={};Se(Xt,{handler:()=>Gt});module.exports=Ee(Xt);var J="4.5.0",I=`astrasync-sdk/${J}`;function Te(e){if(!e)return{"user-agent":I};if(e instanceof Headers){let r=new Headers(e);return r.has("user-agent")||r.set("user-agent",I),r}return Array.isArray(e)?e.some(([n])=>n.toLowerCase()==="user-agent")?e:[...e,["user-agent",I]]:Object.keys(e).some(r=>r.toLowerCase()==="user-agent")?e:{"user-agent":I,...e}}var T=(e,t)=>fetch(e,{...t,headers:Te(t?.headers)}),Wt=Object.freeze({version:1,mode:"observe",depth:"classify",pathRules:[],sampling:Object.freeze({anonymousBeaconRate:.1}),failurePosture:"open"}),Zt=60*1e3,Qt=1440*60*1e3;function Ce(e,t){for(let r of e)if(_e(r.pattern).test(t))return r}function _e(e){let t=e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*");return new RegExp(`^${t}$`,"i")}var Ue=1,Pe=new Set(["cookie","set-cookie","x-csrf-token","proxy-authorization","x-astrasync-signature","x-astrasync-secret","x-hub-signature","x-hub-signature-256","x-astra-verified-hop"]),xe=["x-astrasync-","kya-","kya_"],ke=new Set(["authorization","x-api-key","x-goog-api-key","api-key"]);function Oe(e){return e==="signature"||e.endsWith("-signature")||e.endsWith("-signature-256")}var Me=new Set(["openai-organization","openai-project","openai-version","openai-processing-ms","anthropic-version","anthropic-beta","x-goog-user-project","x-goog-api-client","user-agent","x-agent-card-url","x-agent-provider"]),Fe=["x-goog-","x-stainless-","x-anthropic-","x-openai-","sec-ch-"],De=["sk-ant-api03","sk-ant-api","sk-ant","sk-proj","sk-svcacct","sk-or-v1","sk-or","sk-lf","sk-","gsk_","aiza","ya29","ghp_","gho_","github_pat_","xai-","pplx-","r8_","hf_","astra-","astrae-"],Ne=64,N=1024,Le=16*1024;function _(e){let t=0;for(let r=0;r<e.length;r++){let n=e.charCodeAt(r);n<128?t+=1:n<2048?t+=2:n>=55296&&n<=56319?(t+=4,r++):t+=3}return t}function je(e){if(!e)return;let t=e.trim(),r=t.indexOf(" ");if(r>0){let a=t.slice(0,r).toLowerCase();(a==="bearer"||a==="basic"||a==="token")&&(t=t.slice(r+1).trim())}let n=t.toLowerCase();for(let a of De)if(n.startsWith(a))return a}function $e(e){return!!(Pe.has(e)||xe.some(t=>e.startsWith(t))||Oe(e))}function He(e){return Me.has(e)?!0:Fe.some(t=>e.startsWith(t))}function W(e){let t={},r={},n,a,i=0,o=0;if(!e)return{headers:t};for(let c of Object.keys(e)){if(o>=Ne)break;let l=c.toLowerCase(),u=e[c];if(u===void 0)continue;let g=Array.isArray(u)?u.join(", "):String(u);if(ke.has(l)){let d=je(g);d&&!n&&(n=d);continue}if(l==="cookie"&&(a=g.split(";").filter(d=>d.trim().length>0).length),$e(l))continue;let m=g;_(m)>N&&(m=m.slice(0,N));let h=_(l)+_(m);i+h>Le||(i+=h,o++,t[l]=m,He(l)&&(r[l]=m))}let s={headers:t};return n&&(s.apiKeyFormat=n),Object.keys(r).length>0&&(s.platformHeaders=r),a!==void 0&&(s.cookieCount=a),s}var Be=[{vendor:"claude",displayName:"Anthropic Claude",uaPatterns:[/claude/i,/anthropic/i],agentCardPatterns:[/anthropic\.com/i,/claude\.ai/i],apiKeyFormatPatterns:[/^sk-ant/i],headerPatterns:[/^anthropic-version/i,/^anthropic-beta/i,/^x-anthropic-/i]},{vendor:"chatgpt",displayName:"OpenAI ChatGPT",uaPatterns:[/chatgpt/i,/openai/i,/gpt-?\d/i],agentCardPatterns:[/openai\.com/i,/chatgpt\.com/i],apiKeyFormatPatterns:[/^sk-proj/i,/^sk-svcacct/i],headerPatterns:[/^openai-organization/i,/^openai-project/i,/^openai-version/i]},{vendor:"gemini",displayName:"Google Gemini",uaPatterns:[/gemini/i,/google-gemini/i,/bard/i],agentCardPatterns:[/gemini\.google\.com/i,/ai\.google\.dev/i],apiKeyFormatPatterns:[/^aiza/i],headerPatterns:[/^x-goog-user-project/i,/^x-goog-api-client/i]},{vendor:"cursor",displayName:"Cursor",uaPatterns:[/cursor/i],agentCardPatterns:[/cursor\.sh/i,/cursor\.com/i]},{vendor:"goose",displayName:"Block Goose",uaPatterns:[/goose/i,/block-goose/i],agentCardPatterns:[/block\.xyz\/goose/i,/goose\.tools/i]},{vendor:"perplexity",displayName:"Perplexity",uaPatterns:[/perplexity/i],agentCardPatterns:[/perplexity\.ai/i],apiKeyFormatPatterns:[/^pplx-/i]},{vendor:"chatgpt-atlas",displayName:"ChatGPT Atlas browser",uaPatterns:[/\batlas\/\d/i],headerPatterns:[/^sec-ch-ua: .*atlas/i]},{vendor:"perplexity-comet",displayName:"Perplexity Comet browser",uaPatterns:[/\bcomet\/\d/i],headerPatterns:[/^sec-ch-ua: .*comet/i]},{vendor:"astrasync-sdk",displayName:"AstraSync SDK",uaPatterns:[/^astrasync-sdk\//i]}];function Ke(e,t){let r=t.userAgent??"",n=t.agentCardUrl??"",a=t.apiKeyFormat??"",i=t.ja4??"",o=t.asn??"",s=[];if(t.platformHeaders)for(let[c,l]of Object.entries(t.platformHeaders))s.push(c,`${c}: ${l}`);for(let c of e){let l=c.uaPatterns?.some(p=>p.test(r)),u=c.agentCardPatterns?.some(p=>p.test(n)),g=a.length>0&&c.apiKeyFormatPatterns?.some(p=>p.test(a)),m=s.length>0&&c.headerPatterns?.some(p=>s.some(y=>p.test(y))),h=i.length>0&&c.ja4Patterns?.some(p=>p.test(i)),d=o.length>0&&c.asnList?.includes(o);if(l||u||g||m||h||d){let p=r.split(/[\s/]/)[0]?.toLowerCase()??"",y=(()=>{try{return n?new URL(n).host:""}catch{return""}})(),v=p||y||a||i||o&&`asn${o}`||"unknown";return{vendor:c.vendor,fingerprintKey:`${c.vendor}:${v}`,displayName:c.displayName}}}}function L(e){return Ke(Be,e)}function Ve(e){return e>=80?"PLATINUM":e>=60?"GOLD":e>=40?"SILVER":"BRONZE"}var qt=3600*1e3,ze=new Map;function Ge(e){return ze.get(e)?.data}var Z={apiBaseUrl:"https://astrasync.ai/api",defaultAccessLevel:"none",debug:!1},Q=!1,j=!1;async function $(e,t,r,n){Q=!0;try{let a=`${e}/agents/verify-access`,o=(await T(a,{method:"HEAD"})).headers.get("content-type")??"";if(o.startsWith("text/html")){let s=`[VerificationGateway] apiBaseUrl '${e}' returned HTML (content-type: ${o}). This usually means apiBaseUrl is pointing at a marketing site instead of the API. Expected: 'https://astrasync.ai/api' (prod) or 'https://staging.astrasync.ai/api' (staging).`;if(r)throw new Error(`${s} (strictInit=true)`);console.warn(`${s} Set disableInitChecks: true on GatewayConfig to silence.`)}else t&&console.log(`[VerificationGateway] init check passed for ${e} (content-type: ${o})`);if(n){let s=await T(`${e}/agents/verify-access/self-check`,{headers:{Authorization:`Bearer ${n}`}});if(s.status===401){let c=await s.json().catch(()=>({})),l=`[VerificationGateway] the configured AstraSync API key was REJECTED at startup (${c.code??"api_key_invalid"}: ${c.message??"invalid key"}). Every inbound agent will be turned away until the key is rotated`+(c.remediation?.manageUrl?` at ${c.remediation.manageUrl}`:"")+".";if(r)throw new Error(`${l} (strictInit=true)`);console.error(l)}else if(s.ok){let c=await s.json().catch(()=>({}));typeof c.daysToExpiry=="number"&&c.daysToExpiry<=7?console.warn(`[VerificationGateway] the configured AstraSync API key expires in ${c.daysToExpiry} day(s) \u2014 rotate it at Settings \u2192 Developer Tools before integrations start failing.`):t&&console.log("[VerificationGateway] API key self-check passed")}}}catch(a){if(r)throw a;t&&console.log(`[VerificationGateway] init check failed (non-blocking): ${String(a)}`)}}var P=new Map;function q(e,t){let r=e.credentials;return[r.astraId||"",r.apiKey||"",r.jwt||"",e.purpose||"",e.action||"",e.resourceType||"",e.resource||"",e.jurisdiction||"",e.transactionValue??"",e.currency||"",t||"",e.counterpartyUrl||"",e.counterpartyType||"",e.isSubAgentRequest?"1":"0",e.parentAgentId||"",e.subAgentDepth??"",e.durationRequired??"",e.invocationProtocol||"",e.enableRuntimeChallenge?"1":"0",e.callerMetadata?.sourceIp||"",e.callerMetadata?.userAgent||"",e.callerMetadata?.forwardedFor||"",e.callerMetadata?.agentCardUrl||""].join("|")}function Xe(e,t){let r=q(e,t),n=P.get(r);return n&&n.expiresAt>Date.now()?n.result:(n&&P.delete(r),null)}var Ye=60;function Je(e,t,r,n){let a=r&&r>0?r:Ye,i=q(e,n);P.set(i,{result:t,expiresAt:Date.now()+a*1e3})}function ee(e,t){let r={},n=/^ASTRAE?-[A-Za-z0-9_-]{1,64}$/,a=e["x-astra-id"]||e["X-Astra-Id"]||e["X-ASTRA-ID"]||e["x-astra-agentid"]||e["X-Astra-AgentId"]||e["x-astra-agent-id"]||e["X-Astra-Agent-Id"]||e["X-ASTRA-AGENT-ID"];if(a){let s=Array.isArray(a)?a[0]:typeof a=="string"?a:void 0;typeof s=="string"&&n.test(s)&&(r.astraId=s)}let i=e["x-api-key"]||e["X-Api-Key"]||e["X-API-KEY"];i&&(r.apiKey=Array.isArray(i)?i[0]:i);let o=e.authorization||e.Authorization;if(o){let s=Array.isArray(o)?o[0]:o;typeof s=="string"&&(r.authorizationHeader=s,s.startsWith("Bearer ")&&(r.jwt=s.slice(7)))}return t&&(t.astraId&&!r.astraId&&(r.astraId=t.astraId),t.apiKey&&!r.apiKey&&(r.apiKey=t.apiKey)),r}function We(e,t,r={}){let n=r.source??"no_credentials",a=n==="api_error",i=n==="merchant_misconfig",o=r.urls,s=i?{message:"This site's AstraSync integration is misconfigured (its API key was revoked, expired, or rotated). Your identity and the AstraSync platform are fine \u2014 contact the site operator. Retrying will not help.",registrationUrl:o?.registrationUrl??"",documentationUrl:r.remediation?.docsUrl??o?.documentationUrl??"",steps:["Report the failure to the site operator \u2014 their AstraSync API key needs rotating","Do not retry: the failure is deterministic until the operator updates their key"]}:a?{message:"Verification is temporarily unavailable. Retry with exponential backoff; if the issue persists, contact support with the correlationId.",registrationUrl:o?.registrationUrl??"",documentationUrl:o?.documentationUrl??"",steps:["Retry the request with exponential backoff","If failures persist, share the correlationId with support"]}:{message:"This service verifies AI agents before granting access. Please register your agent with AstraSync.",registrationUrl:o?.registrationUrl??"",documentationUrl:o?.documentationUrl??"",steps:["Register for an AstraSync account","Create and register your agent","Add your ASTRA-ID to request headers","Retry your request"]};return{identityVerified:!1,policyAllowed:!1,accessLevel:"none",guidance:s,denialReasons:t?[t]:["No valid agent credentials provided"],failures:i?[{dimension:"verify_access.merchant_misconfigured",message:t??"The integration API key was rejected by AstraSync",guidance:s.message}]:a?[{dimension:"verify_access.api_error",message:t??"Verification temporarily unavailable",guidance:s.message}]:void 0,...i&&{misconfigured:!0},correlationId:r.correlationId,attemptId:r.attemptId,verifiedAt:new Date}}async function Ze(e,t){let{credentials:r,...n}=t,a={...r.astraId&&{agentId:r.astraId},...n.purpose&&{purpose:n.purpose}};if(n.action&&(a.action=n.action),n.resourceType&&(a.resourceType=n.resourceType),n.resource&&(a.resource=n.resource),n.jurisdiction&&(a.jurisdiction=n.jurisdiction),n.transactionValue&&(a.transactionValue=n.transactionValue),n.currency&&(a.currency=n.currency),n.isSubAgentRequest&&(a.isSubAgentRequest=n.isSubAgentRequest),n.parentAgentId&&(a.parentAgentId=n.parentAgentId),n.subAgentDepth!==void 0&&(a.subAgentDepth=n.subAgentDepth),n.enableRuntimeChallenge&&(a.enableRuntimeChallenge=n.enableRuntimeChallenge),n.createSession&&(a.createSession=n.createSession),n.durationRequired&&(a.durationRequired=n.durationRequired),n.counterpartyType&&(a.counterpartyType=n.counterpartyType),n.counterpartyUrl&&(a.counterpartyUrl=n.counterpartyUrl),e.counterpartyId&&(a.counterpartyId=e.counterpartyId),n.runtimeChallengeOptions&&(a.runtimeChallengeOptions=n.runtimeChallengeOptions),n.invocationProtocol&&(a.invocationProtocol=n.invocationProtocol),n.commerceArtifacts&&(a.commerceArtifacts=n.commerceArtifacts),n.attemptId&&(a.attemptId=n.attemptId),n.considerationSet&&(a.considerationSet=n.considerationSet),a.sdkVersion=J,n.callerMetadata||n.clientIp||n.userAgent){let o={...n.clientIp&&{sourceIp:n.clientIp},...n.userAgent&&{userAgent:n.userAgent},...n.callerMetadata};Object.keys(o).length>0&&(a.callerMetadata=o)}let i={"Content-Type":"application/json",...e.customHeaders};e.apiKey&&(i.Authorization=`Bearer ${e.apiKey}`,i["X-API-Key"]=e.apiKey);try{let o=await T(`${e.apiBaseUrl}/agents/verify-access`,{method:"POST",headers:i,body:JSON.stringify(a),signal:AbortSignal.timeout(e.verifyTimeoutMs??1e4)}),s=await o.json();return o.status===410?{success:!0,attemptId:typeof s?.attemptId=="string"?s.attemptId:void 0,access:{allowed:!1,accessLevel:"none",reason:"endpoint_deactivated",failures:[{dimension:"endpoint.deactivated",message:typeof s?.message=="string"?s.message:"Endpoint has been deactivated",guidance:typeof s?.guidance=="string"?s.guidance:"Reactivate via POST /api/endpoints/{id}/reactivate, or update the URL on the calling agent."}]}}:o.ok?s:o.status===401?{success:!1,error:s.message||s.error||"Integration API key rejected",misconfig:!0,misconfigCode:typeof s?.code=="string"?s.code:void 0,remediation:s?.remediation&&typeof s.remediation=="object"?s.remediation:void 0,correlationId:typeof s?.correlationId=="string"?s.correlationId:void 0,attemptId:typeof s?.attemptId=="string"?s.attemptId:void 0}:{success:!1,error:s.message||s.error||`API returned ${o.status}`,correlationId:typeof s?.correlationId=="string"?s.correlationId:void 0,attemptId:typeof s?.attemptId=="string"?s.attemptId:void 0}}catch(o){return{success:!1,error:`Failed to call verify-access API: ${o instanceof Error?o.message:"Unknown error"}`}}}async function H(e,t,r){let n={...Z,...e},a=n.apiBaseUrl?Ge(n.apiBaseUrl):void 0;if(!Q&&!n.disableInitChecks&&n.apiBaseUrl&&(n.strictInit?await $(n.apiBaseUrl,n.debug,!0,n.apiKey):$(n.apiBaseUrl,n.debug,!1,n.apiKey)),!j&&(e.minTrustScore!==void 0||e.minTrustScoreForFull!==void 0)&&(j=!0,console.warn("[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side.")),n.cacheTtl!==0&&!r?.bypassCache){let y=Xe(t,n.counterpartyId);if(y){n.debug&&console.log("[VerificationGateway] Returning cached result");let v={...y};return t.attemptId?v.attemptId=t.attemptId:delete v.attemptId,v}}let i={...t};!i.counterpartyUrl&&n.counterpartyUrl&&(i.counterpartyUrl=n.counterpartyUrl),!i.counterpartyType&&n.counterpartyType&&(i.counterpartyType=n.counterpartyType),n.debug&&console.log("[VerificationGateway] Calling verify-access API");let o=await Ze(n,i),s=o.denialReasons,c=Array.isArray(s)&&s.length>0?s:void 0;if(!o.success)return We(n,o.error,{source:o.misconfig?"merchant_misconfig":"api_error",correlationId:o.correlationId,attemptId:o.attemptId,remediation:o.remediation,urls:a});if(!o.access?.allowed){let y=o.access?.failures;return{identityVerified:o.verificationContext?.idVerified===!0,policyAllowed:!1,accessLevel:"none",denialReasons:c??(y&&y.length>0?y.map(he=>he.message):o.access?.reason?[o.access.reason]:["Access denied"]),failures:y,requiresStepUp:o.access?.requiresStepUp,requiresApproval:o.access?.requiresApproval,guidance:{message:o.access?.reason||"Access denied by PDLSS policy",registrationUrl:a?.registrationUrl??"",documentationUrl:a?.documentationUrl??""},verifiedAt:new Date,sessionId:o.sessionId,correlationId:o.correlationId,attemptId:o.attemptId,recommendation:o.recommendation,recommendationReasons:o.recommendationReasons,stepUpApproval:o.stepUpApproval,settlement:o.settlement}}let l=o.agent?{astraId:o.agent.astraId,name:o.agent.name,trustScore:o.agent.trustScore,trustLevel:Ve(o.agent.trustScore),blockchainVerified:o.agent.blockchainStatus==="verified",status:o.agent.agentStatus}:void 0,u=o.developer?{astradId:o.developer.kyaOwnerId,name:o.developer.fullName,trustScore:o.developer.trustScore||0,verified:o.developer.identityVerified}:void 0,g=o.organization?{name:o.organization.name,verified:o.organization.verified,trustScore:o.organization.trustScore}:void 0,m=o.verificationContext,h=o.access?.accessLevel??"standard",d={identityVerified:o.verificationContext?.idVerified===!0,policyAllowed:!0,accessLevel:h,agent:l,developer:u,organization:g,appliedPolicy:o.access?.appliedPolicy,verificationContext:m,requiresStepUp:o.access?.requiresStepUp,requiresApproval:o.access?.requiresApproval,verifiedAt:new Date,cacheTtl:n.cacheTtl,sessionId:o.sessionId,correlationId:o.correlationId,attemptId:o.attemptId,runtimeChallenge:o.runtimeChallenge,tokenGuidance:o.tokenGuidance,recommendation:o.recommendation,recommendationReasons:o.recommendationReasons,warningHeader:o.warningHeader,stepUpApproval:o.stepUpApproval,settlement:o.settlement};d.recommendation==="deny"?(d.policyAllowed=!1,d.accessLevel="none",d.denialReasons=c??d.recommendationReasons??["Access denied by AstraSync recommendation"],d.guidance=d.runtimeChallenge?{message:`Verification failed: ${d.runtimeChallenge.reason||"runtime challenge failed"}`,registrationUrl:a?.registrationUrl??"",documentationUrl:a?.documentationUrl??""}:{message:d.recommendationReasons?.[0]||"Access denied by AstraSync recommendation",registrationUrl:a?.registrationUrl??"",documentationUrl:a?.documentationUrl??""}):d.recommendation==="step_up_required"&&(d.requiresStepUp=!0,d.denialReasons=c??d.recommendationReasons??["Step-up verification required"]);let p=d.requiresStepUp===!0||d.requiresApproval===!0||d.recommendation==="step_up_required";return n.cacheTtl!==0&&d.recommendation!=="deny"&&!p&&Je(t,d,n.cacheTtl,n.counterpartyId),d}async function Qe(e,t){let r=e.apiBaseUrl||Z.apiBaseUrl,{counterpartyUrl:n,...a}=t,i={...a,...n&&{counterpartyUrl:n},...e.counterpartyId&&{counterpartyId:e.counterpartyId}};await T(`${r}/verification-activity/unregistered-attempt`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)}).catch(()=>{})}function f(e,t){return e.headers[t.toLowerCase()]}function qe(e,t){let r=e.querystring?`?${e.querystring}`:"";return`https://${t}${e.uri}${r}`}function k(e){let{headers:t,apiKeyFormat:r,platformHeaders:n,cookieCount:a}=W(e.headers),i=e.connection??{},o=rt(e.querystring);return{headers:t,...r&&{apiKeyFormat:r},...n&&{platformHeaders:n},...Object.keys(i).length>0&&{connection:i},...a!==void 0&&{cookieCount:a},...o&&{queryKeys:o},schemaVersion:Ue}}var et=32,tt=64;function rt(e){if(!e)return;let t;try{t=new URLSearchParams(e)}catch{return}let r=[];for(let n of t.keys()){let a=n.toLowerCase().slice(0,tt);if(a&&!r.includes(a)&&(r.push(a),r.length>=et))break}return r.length>0?r:void 0}var nt=/^eyJ[\w-]+\.[\w-]*\.[\w-]+~/;function at(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r=t+"=".repeat((4-t.length%4)%4),n=atob(r),a=new Uint8Array(n.length);for(let i=0;i<n.length;i++)a[i]=n.charCodeAt(i);return new TextDecoder().decode(a)}function ot(e){try{let t=e.split(".")[0];return JSON.parse(at(t))}catch{return}}function it(e){if(e)try{let t=JSON.parse(e);return typeof t=="object"&&t!==null?t:void 0}catch{return}}function st(e,t){let r=qe(e,t),n=e.method,a=e.headers,i=it(e.bodyText),o=e.bodyTruncated?{bodyTruncated:!0}:{},s=f(e,"authorization"),c=s?.replace(/^Bearer\s+/i,""),u=[f(e,"x-payment-mandate")??f(e,"payment-mandate"),c].find(d=>d&&nt.test(d));if(u){let d=ot(u)?.typ;return{protocol:"vi-sd-jwt",artifacts:{viSdJwt:u},evidence:{typ:d,...o}}}let g=f(e,"signature"),m=f(e,"signature-input");if(g&&m){let d=f(e,"signature-agent"),p=f(e,"x-agent-registry"),y=m.toLowerCase();return{protocol:d?"rfc9421-web-bot-auth":p?.toLowerCase().includes("visa")||y.includes("visa")?"rfc9421-tap":p?.toLowerCase().includes("mastercard")||y.includes("mastercard")?"rfc9421-agent-pay":"rfc9421",artifacts:{rfc9421:{headers:a,method:n,url:r,...e.bodyText&&{body:e.bodyText}}},evidence:{...d&&{signatureAgent:d},...p&&{registryHint:p},keyid:m.match(/keyid="([^"]+)"/)?.[1],...o}}}let h=f(e,"timestamp");if(g&&!m&&(h||f(e,"idempotency-key")))return{protocol:"acp",artifacts:{acpRequest:{method:n,url:r,headers:a,...e.bodyText&&{rawBody:e.bodyText},...i&&{body:i}}},evidence:{hasTimestamp:!!h,...o}};if(/\/checkout[-_]sessions(\/|$)/.test(e.uri))return{protocol:"ucp",artifacts:{ucpRequest:{method:n,url:r,...i&&{body:i}}},evidence:{path:e.uri,...o}};if(i){let d=i.intent_mandate??i.intentMandate,p=i.cart_mandate??i.cartMandate,y=i.payment_mandate??i.paymentMandate;if(typeof d=="string"||typeof p=="string"||typeof y=="string")return{protocol:"ap2",artifacts:{ap2Mandates:{...typeof d=="string"&&{intent:d},...typeof p=="string"&&{cart:p},...typeof y=="string"&&{payment:y}}},evidence:{mandatesPresent:[typeof d=="string"&&"intent",typeof p=="string"&&"cart",typeof y=="string"&&"payment"].filter(Boolean),...o}}}if(s&&/^Payment\s+/i.test(s))return{protocol:"mpp",artifacts:{mppRequest:{method:n,url:r,headers:a,...e.bodyText&&{rawBody:e.bodyText},...i&&{body:i}}},evidence:o};if(f(e,"x-payment"))return{protocol:"x402",artifacts:{x402Request:{method:n,url:r,headers:a,...i&&{body:i}}},evidence:o}}var ct=/\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|eot|mp4|webm|pdf|txt|xml)$/i,dt=/^astrasync-sdk\//i,ut=/curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i,lt=/mozilla\/\d/i;function pt(e,t){if(ct.test(t))return{mode:e.mode,depth:e.depth,skip:!0};let r=Ce(e.pathRules,t);return r?{mode:r.mode??e.mode,depth:r.depth??e.depth,skip:r.skip===!0}:{mode:e.mode,depth:e.depth,skip:!1}}function ft(e,t,r){let n=f(e,"user-agent")??"";if(dt.test(n))return{tier:"self"};let a=ee(e.headers,{});if(a.astraId||a.apiKey||a.jwt)return{tier:"verified",protocol:"x-astra"};let{apiKeyFormat:i,platformHeaders:o}=W(e.headers),s={userAgent:n,apiKeyFormat:i,platformHeaders:o};if(r!=="classify"){let l=st(e,t);if(l)return{tier:"identified",protocol:l.protocol,artifacts:l.artifacts,evidence:l.evidence,fingerprint:L(s)}}let c=L(s);return c?{tier:"identified",protocol:"platform-ua",fingerprint:c}:!n||ut.test(n)||!lt.test(n)?{tier:"anonymous-bot",evidence:{userAgent:n||"(none)"}}:!f(e,"sec-fetch-mode")&&!f(e,"accept-language")?{tier:"anonymous-bot",evidence:{userAgent:n,spoofedBrowser:!0}}:{tier:"human"}}var gt={"vi-sd-jwt":"This request presented Visa Intelligent Commerce credentials, but the agent is not verified with AstraSync. Register the agent to pair your VI credentials with a verified identity and mandate.","rfc9421-agent-pay":"This request carried a Mastercard Agent Pay signature, but the agent is not verified with AstraSync. Register the agent to pair Agent Pay credentials with a verified identity and mandate.","rfc9421-tap":"This request carried a Visa TAP signature, but the agent is not verified with AstraSync. Register the agent to pair TAP credentials with a verified identity and mandate.","rfc9421-web-bot-auth":"This request carried a Web Bot Auth signature, but the agent is not verified with AstraSync. Register the agent to link your signed-agent identity to a verified principal.",rfc9421:"This request carried an RFC 9421 HTTP message signature, but the agent is not verified with AstraSync. Register the agent to link the signing identity to a verified principal.",acp:"This request used the Agentic Commerce Protocol, but the agent is not verified with AstraSync. Register the agent to transact on this property.",ucp:"This request used a UCP checkout session, but the agent is not verified with AstraSync. Register the agent to transact on this property.",ap2:"This request presented AP2 mandates, but the agent is not verified with AstraSync. Register the agent to pair your mandates with a verified identity.",mpp:"This request presented MPP payment credentials, but the agent is not verified with AstraSync. Register the agent to transact on this property.",x402:"This request used x402 payment headers, but the agent is not verified with AstraSync. Register the agent to transact on this property.","platform-ua":"This traffic was identified as a platform AI agent without AstraSync credentials. Register the agent to access this property with a verified identity.","x-astra":"The presented AstraSync credentials failed verification or were denied by this property\u2019s access policy."};function yt(e,t){let r=t.replace(/\/api\/?$/,""),n=(e.protocol&&gt[e.protocol])??"This request could not be verified by AstraSync.";return{success:!1,error:{code:e.tier==="verified"?"INSUFFICIENT_ACCESS":"UNAUTHORIZED",message:n,...e.protocol&&{protocol:e.protocol},failures:e.reasons,...e.correlationId&&{correlationId:e.correlationId},guidance:{message:e.guidance?.message||"Register this agent with AstraSync to receive verifiable credentials.",registrationUrl:e.guidance?.registrationUrl||`${r}/register`,documentationUrl:e.guidance?.documentationUrl||`${r}/docs/edge-adapter`}}}}function mt(e){return{success:!1,error:{code:"VERIFICATION_UNAVAILABLE",message:"Agent verification is temporarily unavailable and this path enforces verification. Your identity was not evaluated and no denial was recorded \u2014 retry with exponential backoff.",failures:e.reasons,...e.correlationId&&{correlationId:e.correlationId},guidance:{message:"Retry the request with exponential backoff; the condition is transient."}}}}function ht(e){return{success:!1,status:"manual_review",message:"This action requires human approval. Poll the step-up approval endpoint and retry once approved.",...e.stepUp&&{stepUpApproval:e.stepUp},...e.correlationId&&{correlationId:e.correlationId}}}var vt="X-Astra-Verified-Hop";function At(e){return`${e.astraId};${e.sessionId??""};${e.checkedAt}`}var b={trustScore:"X-AstraSync-Trust-Score",agentId:"X-AstraSync-Agent-Id",developerId:"X-AstraSync-Developer-Id",permissions:"X-AstraSync-Permissions",observedDecision:"X-AstraSync-Observed-Decision"},B=["x-astrasync-","x-astra-verified-hop"];function U(){return{action:"pass",injectHeaders:{},stripHeaderPrefixes:[]}}function wt(e,t,r){let n={};if(t.misconfig&&(n[b.observedDecision]="misconfig"),r.mode!=="enforce")return t.decision!=="allow"&&(n[b.observedDecision]=t.decision),Object.assign(n,K(t),V(t)),{action:"pass",injectHeaders:n,stripHeaderPrefixes:B};switch(t.decision){case"deny":return t.unavailable?{action:"respond",status:503,headers:{"Retry-After":"30"},bodyJson:mt(t)}:{action:"respond",status:403,headers:{},bodyJson:yt(t,e.apiBaseUrl)};case"manual_review":return{action:"respond",status:202,headers:{"Retry-After":"30"},bodyJson:ht(t)};default:return Object.assign(n,K(t),V(t)),{action:"pass",injectHeaders:n,stripHeaderPrefixes:B}}}function K(e){if(!e.asat)return{};let{trustScore:t,agentId:r,developerId:n,accessLevel:a}=e.asat;return{...t!==void 0&&{[b.trustScore]:String(t)},...r&&{[b.agentId]:r},...n&&{[b.developerId]:n},...a&&{[b.permissions]:a}}}function V(e){let t=e.asat?.agentId;return t?{[vt]:At({astraId:t,...e.sessionId&&{sessionId:e.sessionId},checkedAt:Date.now()})}:{}}var bt={GET:"data.read",HEAD:"data.read",OPTIONS:"data.read",POST:"data.write",PUT:"data.write",PATCH:"data.write",DELETE:"data.delete"},Rt="data.write",St="data";function It(e){return bt[e.toUpperCase()]??Rt}function Et(e){let t=e.indexOf(":");if(t>=0)return{purpose:e.slice(0,t)};let r=e.indexOf(".");return r>0&&r<e.length-1?{purpose:e.slice(0,r),actionCandidate:e}:{purpose:e}}function Tt(e){let t=e.astraPurpose?Et(e.astraPurpose):void 0,r,n;e.routeAction?(r=e.routeAction,n="route_config"):e.hasCustomActionExtractor&&e.customAction?(r=e.customAction,n="custom_extractor"):!e.hasCustomActionExtractor&&e.astraAction?(r=e.astraAction,n="header"):!e.hasCustomActionExtractor&&t?.actionCandidate?(r=t.actionCandidate,n="purpose_header_derived"):(r=It(e.method),n="method_table");let a,i;if(e.routePurpose?(a=e.routePurpose,i="route_config"):e.hasCustomPurposeExtractor?e.customPurpose&&(a=e.customPurpose,i="custom_extractor"):t?(a=t.purpose,i="header"):e.legacyPurpose?(a=e.legacyPurpose,i="legacy_header"):e.queryPurpose&&(a=e.queryPurpose,i="query"),!a){let o=r.indexOf(".");o>0?(a=r.slice(0,o),i="action_derived"):(a=St,i="transport_default")}return{purpose:a,action:r,purposeSource:i,actionSource:n}}async function x(e,t){let r;try{return await Promise.race([e,new Promise(n=>{r=setTimeout(()=>n(void 0),t)})])}catch{return}finally{r&&clearTimeout(r)}}async function z(e,t,r,n){let a=x(Qe({apiBaseUrl:e.apiBaseUrl,counterpartyId:e.counterpartyId},{counterpartyUrl:e.counterpartyUrl,counterpartyType:"website",sourceIp:t.clientIp,userAgent:f(t,"user-agent"),requestPath:t.uri,requestMethod:t.method,protocol:r.protocol,evidence:r.evidence,observedMetadata:k(t)}),n);if(e.waitUntil){e.waitUntil(a);return}await a}function Ct(e,t=Math.random){return e<=0?!1:e>=1?!0:t()<e}function A(e){return{tier:e.tier,decision:"allow",reasons:[],protocol:e.protocol}}function G(e,t,r,n){let a=Tt({method:t.method,astraPurpose:f(t,"x-astra-purpose"),astraAction:f(t,"x-astra-action")}),i=f(t,"x-astra-attempt-id");return{...i&&/^att_[0-9a-f]{32}$/.test(i)&&{attemptId:i},credentials:ee(t.headers,{}),purpose:a.purpose,action:a.action,resource:t.uri,createSession:!0,counterpartyType:"website",counterpartyUrl:e.counterpartyUrl,callerMetadata:{sourceIp:t.clientIp,userAgent:f(t,"user-agent"),referer:f(t,"referer"),host:f(t,"host"),observedMetadata:k(t)},...n&&r.artifacts&&{commerceArtifacts:r.artifacts}}}function X(e,t){let r=A(e);return r.sessionId=t.sessionId,r.correlationId=t.correlationId,r.guidance=t.guidance,t.misconfigured?(r.reasons=["verification key misconfigured \u2014 fail-open (merchant_misconfig)"],r.misconfig=!0,r):t.requiresStepUp||t.stepUpApproval?(r.decision="manual_review",r.reasons=["step-up approval required"],r.stepUp={pollUrl:t.stepUpApproval?.pollUrl,expiresAt:t.stepUpApproval?.expiresAt},r):!t.identityVerified||!t.policyAllowed?(r.decision="deny",r.reasons=t.denialReasons?.length?t.denialReasons:[t.identityVerified?"denied by access policy":"identity not verified"],r):(r.asat={trustScore:t.agent?.trustScore,agentId:t.agent?.astraId,developerId:t.developer?.astradId,accessLevel:t.accessLevel},r)}function E(e,t,r,n){let a=A(e);return a.unavailable=!0,a.reasons=[r],n&&(a.correlationId=n),t.mode==="enforce"&&(a.decision="deny"),a}function Y(e){return(e.failures??[]).some(t=>t.dimension==="verify_access.api_error")===!0&&!e.misconfigured}async function _t(e,t,r,n,a,i){let o=e.budgets??{},s=o.beaconMs??300,c=n.mode==="enforce"?o.verifyEnforceMs??3e3:o.verifyObserveMs??1500,l={apiBaseUrl:e.apiBaseUrl,...a&&{apiKey:a},counterpartyId:e.counterpartyId,disableInitChecks:!0};try{switch(r.tier){case"verified":{if(n.depth==="classify")return A(r);let u=await x(H(l,G(e,t,r,n.depth==="authorize")),c);return u?Y(u)?E(r,n,u.denialReasons?.[0]??"verify-access api error",u.correlationId):X(r,u):E(r,n,"verify-access unreachable within budget")}case"identified":{if(n.depth==="authorize"&&r.artifacts){let g=await x(H(l,G(e,t,r,!0)),c);return g?Y(g)?E(r,n,g.denialReasons?.[0]??"verify-access api error",g.correlationId):X(r,g):E(r,n,"verify-access unreachable within budget")}await z(e,t,r,s);let u=A(r);return n.mode==="enforce"&&n.depth!=="classify"&&(u.decision="deny",u.reasons=["agent is not registered with AstraSync"]),u}case"anonymous-bot":return Ct(i.anonymousBeaconRate,e.random)&&await z(e,t,{...r,protocol:r.protocol??"ua-heuristic"},s),A(r);default:return A(r)}}catch(u){let g=A(r);return g.reasons=[`edge pipeline error \u2014 fail-open: ${u instanceof Error?u.message:String(u)}`],g}}async function te(e,t,r,n){let a=pt(r,t.uri);try{if(a.skip)return{policy:a,application:U()};let i=f(t,"x-forwarded-host")??f(t,"host")??new URL(e.counterpartyUrl).host,o=ft(t,i,a.depth);if(o.tier==="human"||o.tier==="self")return{policy:a,classification:o,application:U()};let s=await _t(e,t,o,a,n,r.sampling);return s.decision!=="allow"&&e.log?.("info",a.mode==="enforce"?`${s.decision.toUpperCase()}: ${t.method} ${t.uri}`:`[OBSERVE] would have been ${s.decision.toUpperCase()}: ${t.method} ${t.uri}`,{tier:s.tier,protocol:s.protocol,reasons:s.reasons}),{policy:a,classification:o,outcome:s,application:wt(e,s,a)}}catch(i){return e.log?.("error","edge evaluation error \u2014 passing request through",{error:i instanceof Error?i.message:String(i)}),{policy:a,application:U()}}}function re(e){return e.Records[0].cf.request}function w(e,t){return e.headers[t.toLowerCase()]?.[0]?.value}function Ut(e){let t={};for(let[r,n]of Object.entries(e))n?.length&&(t[r]=n.map(a=>a.value).join(", "));return t}function Pt(e){let t=e.body;return t?.data?{text:t.encoding==="base64"?Buffer.from(t.data,"base64").toString("utf8"):t.data,truncated:t.inputTruncated===!0}:{truncated:!1}}function xt(e){let t={},r=(i,o,s)=>{let c=w(e,o);c&&(t[i]=s?s(c):c)},n=w(e,"cloudfront-viewer-address");if(n){t.ip=n.replace(/:\d+$/,"");let i=n.match(/:(\d+)$/);i&&(t.sourcePort=i[1])}r("country","cloudfront-viewer-country"),r("countryName","cloudfront-viewer-country-name"),r("region","cloudfront-viewer-country-region"),r("countryRegionName","cloudfront-viewer-country-region-name"),r("city","cloudfront-viewer-city"),r("latitude","cloudfront-viewer-latitude"),r("longitude","cloudfront-viewer-longitude"),r("postalCode","cloudfront-viewer-postal-code"),r("asn","cloudfront-viewer-asn"),r("tlsVersion","cloudfront-viewer-tls");{let i=w(e,"cloudfront-viewer-tls")?.split(":")[1];i&&(t.tlsCipher=i)}r("httpVersion","cloudfront-viewer-http-version"),r("timeZone","cloudfront-viewer-time-zone"),r("metroCode","cloudfront-viewer-metro-code"),r("tlsFingerprint","cloudfront-viewer-ja3-fingerprint"),r("ja4","cloudfront-viewer-ja4-fingerprint"),r("headerOrder","cloudfront-viewer-header-order",i=>i.slice(0,256)),r("headerCount","cloudfront-viewer-header-count");let a=[];for(let[i,o]of[["desktop","cloudfront-is-desktop-viewer"],["mobile","cloudfront-is-mobile-viewer"],["tablet","cloudfront-is-tablet-viewer"],["smarttv","cloudfront-is-smarttv-viewer"]])w(e,o)==="true"&&a.push(i);return a.length&&(t.device=a.join(",")),t}function ne(e){let t=Pt(e),r=xt(e),n=w(e,"cloudfront-viewer-address")?.split(":")[0];return{method:e.method,uri:e.uri,querystring:e.querystring??"",headers:Ut(e.headers),...t.text!==void 0&&{bodyText:t.text},...t.truncated&&{bodyTruncated:!0},...n&&{clientIp:n},...Object.keys(r).length>0&&{connection:r}}}function ae(e,t){if(t.action==="respond")return Ot(t.status,t.bodyJson,t.headers);for(let r of t.stripHeaderPrefixes)kt(e,r);for(let[r,n]of Object.entries(t.injectHeaders))O(e,r,n);return e}function oe(e){let t=e.origin?.custom?.domainName??e.origin?.s3?.domainName??void 0;if(!t)return;let r=w(e,"host");!r||r===t||(w(e,"x-forwarded-host")||O(e,"X-Forwarded-Host",r),O(e,"Host",t))}function O(e,t,r){e.headers[t.toLowerCase()]=[{key:t,value:r}]}function kt(e,t){let r=t.toLowerCase();for(let n of Object.keys(e.headers))n.startsWith(r)&&delete e.headers[n]}function Ot(e,t,r){let n={"content-type":[{key:"Content-Type",value:"application/json"}]};for(let[a,i]of Object.entries(r??{}))n[a.toLowerCase()]=[{key:a,value:i}];return{status:String(e),statusDescription:e===403?"Forbidden":e===202?"Accepted":"OK",headers:n,body:JSON.stringify(t)}}var Mt="4.5.0",C=`astrasync-sdk/${Mt}`;function Ft(e){if(!e)return{"user-agent":C};if(e instanceof Headers){let r=new Headers(e);return r.has("user-agent")||r.set("user-agent",C),r}return Array.isArray(e)?e.some(([n])=>n.toLowerCase()==="user-agent")?e:[...e,["user-agent",C]]:Object.keys(e).some(r=>r.toLowerCase()==="user-agent")?e:{"user-agent":C,...e}}var Dt=(e,t)=>fetch(e,{...t,headers:Ft(t?.headers)}),F=Object.freeze({version:1,mode:"observe",depth:"classify",pathRules:[],sampling:Object.freeze({anonymousBeaconRate:.1}),failurePosture:"open"}),ie=["observe","enforce"],se=["classify","authenticate","authorize"];function Nt(e){if(typeof e!="object"||e===null)return!1;let t=e;if(t.version!==1||!ie.includes(t.mode)||!se.includes(t.depth)||!Array.isArray(t.pathRules))return!1;for(let n of t.pathRules){if(typeof n!="object"||n===null)return!1;let a=n;if(typeof a.pattern!="string"||a.pattern.length===0||a.mode!==void 0&&!ie.includes(a.mode)||a.depth!==void 0&&!se.includes(a.depth))return!1}let r=t.sampling;return typeof r!="object"||r===null||typeof r.anonymousBeaconRate!="number"||r.anonymousBeaconRate<0||r.anonymousBeaconRate>1?!1:t.failurePosture==="open"}async function Lt(e,t,r){if(!t)return null;let n={Accept:"application/json"};e.apiKey&&(n.Authorization=`Bearer ${e.apiKey}`,n["X-API-Key"]=e.apiKey),r?.etag&&(n["If-None-Match"]=r.etag);try{let a=await Dt(`${e.apiBaseUrl}/endpoints/${encodeURIComponent(t)}/edge-config`,{method:"GET",headers:n,signal:AbortSignal.timeout(r?.timeoutMs??5e3)});if(a.status===304)return{notModified:!0};if(!a.ok)return null;let o=(await a.json()).data?.edgeConfig;return Nt(o)?{edgeConfig:o,etag:a.headers.get("etag")??void 0}:null}catch{return null}}var jt=60*1e3,$t=1440*60*1e3,R=new Map,M=new Map;function de(e,t){return`${e}|${t}`}function Ht(e){return e.mode!=="enforce"&&!e.pathRules.some(t=>t.mode==="enforce")?e:{...e,mode:"observe",pathRules:e.pathRules.map(t=>t.mode==="enforce"?{...t,mode:"observe"}:t)}}async function ce(e,t){let r=de(e.apiBaseUrl,t),n=M.get(r);if(n)return n;let a=Lt(e,t,{etag:R.get(r)?.etag}).then(i=>{if(i===null)return;let o=Date.now();if("notModified"in i){let s=R.get(r);s&&(s.lastSuccessAt=o);return}R.set(r,{config:i.edgeConfig,etag:i.etag,lastSuccessAt:o})}).finally(()=>{M.delete(r)});return M.set(r,a),a}async function ue(e,t,r){let n=r?.ttlMs??jt,a=r?.maxStaleMs??$t,i=de(e.apiBaseUrl,t),o=R.get(i);if(o){let s=Date.now()-o.lastSuccessAt;return s>n&&ce(e,t).catch(()=>{}),s>a?Ht(o.config):o.config}return await ce(e,t).catch(()=>{}),R.get(i)?.config??F}var Bt=900*1e3,le=new Map;async function Kt(e){let{SecretsManagerClient:t,GetSecretValueCommand:r}=await import("@aws-sdk/client-secrets-manager");return(await new t({region:"us-east-1"}).send(new r({SecretId:e}))).SecretString??void 0}async function pe(e){if(e.apiKey)return e.apiKey;let t=e.apiKeySecretName;if(!t)return;let r=le.get(t);if(r&&Date.now()-r.fetchedAt<Bt)return r.value;try{let a=await(e.fetchSecret??Kt)(t);return le.set(t,{value:a,fetchedAt:Date.now()}),a}catch(n){return e.log?.("warn","Secrets Manager fetch failed \u2014 continuing keyless",{secretName:t,error:n instanceof Error?n.message:String(n)}),r?.value}}async function fe(e,t){try{return await ue({apiBaseUrl:e.apiBaseUrl,apiKey:t},e.counterpartyId,{ttlMs:e.configTtlMs})}catch{return e.fallbackConfig??F}}function ge(e){let t=e.log??((r,n,a)=>{console[r==="info"?"log":r](`[astrasync-edge] ${n}`,a??"")});return async function(n){let a=re(n);try{oe(a);let i=await pe({...e,log:t}),o=await fe(e,i),{application:s}=await te({...e,log:t},ne(a),o,i);return ae(a,s)}catch(i){return t("error","edge handler error \u2014 passing request through",{error:i instanceof Error?i.message:String(i)}),a}}}var Vt="https://astrasync.ai/api",ye="",me="",zt=void 0;(!ye||!me)&&console.error("[astrasync-edge] ASTRASYNC_COUNTERPARTY_ID / ASTRASYNC_COUNTERPARTY_URL were not baked into the bundle \u2014 rebuild via infra/deploy.sh with the ASTRASYNC_* env vars set.");var Gt=ge({apiBaseUrl:Vt,counterpartyId:ye,counterpartyUrl:me,apiKeySecretName:zt});0&&(module.exports={handler});

package/infra/deploy.sh

@@ -6,7 +6,15 @@
 set -euo pipefail
 
 # ---- Deployment constants (baked into the bundle: Lambda@Edge has no env vars)
-export ASTRASYNC_API_BASE_URL="${ASTRASYNC_API_BASE_URL:-https://staging.astrasync.ai/api}"
+#
+# ASTRASYNC_API_BASE_URL MUST point at the AstraSync backend DIRECTLY — never
+# at a hostname this CloudFront distribution (or any gateway-fronted
+# distribution) serves. Routing it through the distribution makes every
+# beacon/verify call re-enter the Lambda, which throttled staging in 2.3.0
+# (each SDK call = one extra Lambda invocation; pre-4.5.0 SDKs looped
+# outright). Direct origin also saves a CloudFront hop per call.
+# e.g. https://staging-origin.astrasync.ai/api — NOT https://staging.astrasync.ai/api
+export ASTRASYNC_API_BASE_URL="${ASTRASYNC_API_BASE_URL:?Set ASTRASYNC_API_BASE_URL to the backend's DIRECT origin URL (never the CloudFront-fronted hostname — see comment above)}"
 export ASTRASYNC_COUNTERPARTY_ID="${ASTRASYNC_COUNTERPARTY_ID:?Set ASTRASYNC_COUNTERPARTY_ID to the property's ASTRAE-id}"
 export ASTRASYNC_COUNTERPARTY_URL="${ASTRASYNC_COUNTERPARTY_URL:?Set ASTRASYNC_COUNTERPARTY_URL, e.g. https://staging.astrasync.ai}"
 export ASTRASYNC_API_KEY_SECRET_NAME="${ASTRASYNC_API_KEY_SECRET_NAME:-astrasync/edge/staging-astrasync-ai}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrasyncai/adapter-lambda",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "AstraSync Trusted Agent Gateway — Lambda@Edge/CloudFront adapter",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -46,7 +46,7 @@
     "directory": "packages/adapter-lambda"
   },
   "dependencies": {
-    "@astrasyncai/verification-gateway": "^4.4.0",
+    "@astrasyncai/verification-gateway": "^4.5.0",
     "@aws-sdk/client-secrets-manager": "^3.632.0"
   },
   "devDependencies": {